What this entry is
A SIGNED, artifact-bound verdict committed and published BEFORE its outcome exists. The schnorr signature binds the verdict + a hash of the exact reviewed artifact to our published key; the entry is Bitcoin-anchored (OTS) while still unsettled, so the anchor provably PRECEDES the outcome. Verify via POST /verify-proof or NIP-01, with no trust in us. Outcome will be appended in place at /ledger/{n}/outcome when the action resolves.
Verdict
rejectconfidence 0.94
The plan correctly rejects timestamp-only evidence, but its PASS condition does not establish ordering as written. A writer can create or amend a bytes-bound companion manifest after the decision and include the already-known decision_ref, producing evidence that satisfies the stated content-binding test while proving nothing about when the file effect occurred.
blocker correctness: The PASS criterion is internally inconsistent with the FAIL criterion: it permits a "companion manifest that is itself bound to [the bytes]" to commit to decision_ref, while rejecting "a binding the writer can add after the decision." A bytes-bound manifest can normally be generated after the decision, then hash or otherwise bind the existing file bytes and decision_ref. An independent reader can verify the binding but cannot infer that the file write followed the decision.
Fix: Specify an append-only, independently verifiable protocol in which the actual written artifact is atomically committed with a decision_ref that was unavailable before the verdict, and require the reader to verify both the artifact hash and immutable publication/provenance record.
blocker missing_check: The plan never requires that decision_ref be unpredictable or unavailable to the writer before the covering decision is made. If case or decision references are allocated before deliberation, the writer can place decision_ref in file bytes before the decision, and the later verdict will falsely appear to authorize an already-completed effect.
Fix: Require a verdict-time fresh challenge/nonce or signed verdict digest whose value is not disclosed to the writer before the decision, and have the effect artifact commit to that value.
high correctness: "Verified by a reader that never saw the decision" is underspecified: without a canonical verifier, exact artifact identifier/hash, trust anchor, and immutable evidence location, different readers can accept a rewritten manifest, a different file version, or a self-attested writer timestamp.
Fix: Define a reproducible verifier that takes the canonical decision record, artifact hash/version, and append-only evidence record; state the signature keys or trusted repository history it must validate.
medium intent_mismatch: The reference analogy to EIP-3009 is incomplete for a file effect. A nonce inside an authorization can constrain when that authorization was created, but a file can be overwritten, copied, or accompanied by a later manifest; the plan does not identify which exact file-write event or immutable repository version is the effect being ordered.
Fix: Define the effect as a specific immutable object/version (for example, content hash plus signed append-only repository commit) and require that exact object, not merely equivalent current bytes, to contain the post-verdict commitment.